STIG Rule RHEL-07-021340 - The system must use a separate file system for /tmp about puppet-systemd HOT 9 CLOSED

You could manage the service pretty easily with:

if $facts['systemd'] {
  service{'tmp.mount':
    ensure   => 'running',
    enabled => true
  }
}

I am not sure if this should be handled within this module or a profile, but probably the latter.

from puppet-systemd.

After going thru the module, I am not sure how to attempt this

from puppet-systemd.

@linuxdan You don't. https://github.com/simp/pupmod-simp-simp/blob/master/manifests/mountpoints/tmp.pp

Turns out, we made a whole framework for just what you're trying to do.

from puppet-systemd.

@trevor-vaughan
But I do not have the authority to drop SIMP into the mix.

from puppet-systemd.

@trevor-vaughan
Also, after looking at your code, I suspect it would fail the check as well.
All this STIG-ish garbage I am posting comes out of Nessus scans.

Try the systemctl is-enabled tmp.mount command on your system.

from puppet-systemd.

@linuxdan The tmp.mount service doesn't really have anything to do with the systemd module, it's just a built-in feature of EL7 and can be enabled using systemctl and, I believe, is on by default.

The code that I posted meets the actual STIG requirements.

Anyway, I would recommend closing this since it doesn't have anything really to do with the systemd module.

from puppet-systemd.

The man page says that the systemctl command controls the systemd system.
If not with this systemd module, how would you suggest I get Puppet to check the output of
systemctl is-enabled tmp.mount
and then respond, if necessary, with
systemctl enable tmp.mount
?

from puppet-systemd.

Did some searching.
I may be able to do this with the Puppet service type.
Also, see https://tickets.puppetlabs.com/browse/PUP-3483 for some interesting reading.
I will share what I find.

from puppet-systemd.

@bastelfreak
I tried it and it works great. Running with debug, I see puppet running /bin/systemctl is-active tmp.mount and /bin/systemctl is-enabled tmp.mount but there is no such fact as "systemd".

This resource declaration is in a RHEL 7 only manifest file, but I added provider => 'systemd', just to be extra-certain. it runs with no problem.

NOW I can close this issue

from puppet-systemd.